Senior Governance, Risk and Compliance Manager

oHallo is hiring a senior governance, risk and compliance manager to take responsibility for information security, data protection and AI governance, measured against recognised international standards and European regulation. The role suits someone who has led compliance at software companies and wants to apply that experience to one of the most consequential questions in technology today: how autonomous AI agents earn the trust of the organisations that deploy them.

Software that acts on its own inside business systems is a new kind of product, and the rules that govern it are being written now. The EU AI Act is entering application in stages, NIS2 has widened the circle of organisations with security obligations, and customers assess every supplier of AI systems with growing rigour. The work therefore combines established disciplines, such as information security management and data protection, with questions that recognised standards are only beginning to answer.

The role has real breadth. It spans the product, the company and its suppliers, and the judgement you bring will shape both how oHallo is built and how it is trusted by the companies that rely on it.

Responsibilities

• You drive and continuously ensure compliance with recognised standards such as ISO/IEC 27001 and SOC 2.
• You interpret European regulation as it develops, including GDPR, the EU AI Act and NIS2, and turn it into requirements that engineers can build against and auditors can test.
• You govern the responsible use of AI systems, applying emerging frameworks to questions of transparency, human oversight, data use and accountability.
• You identify, assess and manage risk across information security, data protection and the use of AI systems, and you give leadership a clear basis for every decision.
• You own the policies, standards and procedures, together with the training that keeps them in everyday practice.
• You plan and lead internal and external audit activity.
• You assess suppliers and sub-processors against the requirements that apply to them.
• You answer customers’ security, privacy and AI governance questions with precision, through questionnaires, due diligence and contract negotiation.
• You work closely with product and engineering, so that requirements are understood early and met by design.
• You advise colleagues across the company and report clearly to management on compliance and risk.

What we are looking for

• At least eight years in governance, risk and compliance, information security assurance or IT audit, with a substantial part of that time spent at software or cloud companies.
• Proven experience leading ISO/IEC 27001 and SOC 2 programmes end to end, from scoping and control design to independent assessment.
• Practical depth in GDPR, including data processing agreements, records of processing and data subject rights, together with a working knowledge of the EU AI Act and NIS2.
• The technical fluency to understand cloud architecture, software delivery and data flows well enough to assess a control yourself and to discuss it credibly with engineers.
• An understanding of how systems built on language models behave, where their risks lie and how those risks are governed.
• Fluency with language models as professional instruments in your own work, with sound judgement about what their output can and cannot establish.
• Experience meeting the security and privacy scrutiny of demanding customers, and the ability to explain requirements clearly to engineers, executives and auditors alike.
• The judgement to distinguish what a standard requires from what it merely suggests, and the pragmatism to apply that distinction.
• Professional written and spoken English, which is our working language.

A certification such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CISM or CIPP/E is valuable. Familiarity with ISO/IEC 42001 or the NIST AI Risk Management Framework is a strong advantage, as is experience in regulated sectors such as financial services or insurance. Danish is an advantage.

Location

The role is based in Copenhagen with a hybrid working arrangement. Our working language is English.

How to apply

In your motivation, include the compliance programmes you have led, what they achieved and why this role interests you.